HTTP Header Viewer: Inspect Response Headers
Our HTTP header viewer lets you inspect the response headers of any URL. See status codes, content types, caching directives, security headers, and CORS configuration. Click any header to see its explanation and full value.
HTTP headers are metadata sent with requests and responses. They control caching, security, content negotiation, and more. Understanding headers is essential for web developers, security researchers, and system administrators.
Key Headers Explained
Content-Type: Tells the browser what type of content is being served (HTML, JSON, images, etc.).
Cache-Control: Directives for how responses should be cached by browsers and CDNs.
Set-Cookie: Cookies sent from server to client for session management.
Location: Used in redirects (3xx responses) to specify the new URL.
Server: Identifies the web server software (often hidden for security).
Security Headers
Modern websites should implement these security headers:
Strict-Transport-Security (HSTS): Forces browsers to use HTTPS.
Content-Security-Policy (CSP): Controls which resources can be loaded, preventing XSS attacks.
X-Frame-Options: Prevents clickjacking by controlling iframe embedding.
X-Content-Type-Options: Prevents MIME type sniffing attacks.
Referrer-Policy: Controls how much referrer information is sent.
CORS Headers
Cross-Origin Resource Sharing (CORS) headers control which domains can access your API:
Access-Control-Allow-Origin: Specifies allowed origins (* for any, or specific domain).
Access-Control-Allow-Methods: Which HTTP methods are permitted (GET, POST, etc.).
Access-Control-Allow-Headers: Which request headers are allowed.
Access-Control-Allow-Credentials: Whether cookies/auth can be included.
FAQ
Why can't I see all headers?
Some headers are filtered by the server or marked as sensitive. Also, this tool shows response headers, not request headers.
What do the status codes mean?
2xx = Success, 3xx = Redirect, 4xx = Client Error, 5xx = Server Error. Common codes: 200 OK, 301 Moved Permanently, 404 Not Found, 500 Internal Server Error.